Copilot commented on code in PR #14570:
URL: https://github.com/apache/cloudstack/pull/14570#discussion_r4523750564
##########
.github/workflows/sbom.yml:
##########
@@ -35,15 +35,18 @@ jobs:
with:
persist-credentials: false
+ - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #
v6.4.0
+ with:
+ node-version: 24
Review Comment:
The PR description states the generator needs Node >= 20.18, but the
workflow pins to Node 24. Using a very new major can introduce avoidable
breakage (ecosystem/tooling changes, transient incompatibilities) without
adding SBOM value. Consider pinning to the minimum supported LTS line (e.g.,
20.18.x or the current LTS major used by the repo) to reduce CI volatility
while still meeting the tool's requirements.
##########
.github/workflows/sbom.yml:
##########
@@ -62,7 +65,7 @@ jobs:
uses: ./.github/actions/setup-env
- name: Generate Java SBOM
Review Comment:
This still invokes the plugin goal directly, while the PR description says
the job can now run `mvn -Dnoredist -Psbom validate` (with the plugin bound to
`validate` in the `sbom` profile) and complete faster. Switching the workflow
to run the lifecycle phase (validate) better matches the new POM design and the
stated performance/behavior expectations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
